Executive brief
The Linux kernel's ext4 filesystem contains a race condition in direct I/O (DIO) handling that can cause data corruption and I/O errors when buffered writes are mixed with concurrent direct I/O operations. A user triggering concurrent write patterns could experience file write failures, invalid data on disk, or filesystem errors without requiring special privileges or network access.
Technical details
The vulnerability is a race condition between asynchronous direct I/O completion and buffered write fallback in ext4_dio_write_iter(). When DIO falls back to buffered I/O (e.g., on no-extent inodes writing to holes), the inode lock is released after buffered write operations dirty pages, creating an unprotected window where concurrent DIO completions invoke kiocb_invalidate_post_direct_write(). If in-flight DIO from other threads complete during this window and find re-dirtied pages, the invalidation logic triggers a stale pagecache warning and sets -EIO in the error sequence. The root cause is insufficient synchronization—in-flight DIO is not drained before the buffered write fallback path invalidates pages. The fix adds inode_dio_wait() at the start of the buffered write path to drain all in-flight DIO, ensuring page invalidation completes before new buffered writes proceed. Local user processes can trigger this via overlapping DIO patterns or loop devices with concurrent backing-file I/O.
Affected products
- Linux Linux kernel <unknown>
Timeline
- 2026-09-17: disclosed